Cloud bills grow the way gardens grow weeds: nobody plants them, they just appear. Every cost review we have run has found 30 to 40 percent of spend doing nothing useful, and the findings repeat so reliably across companies that we now work through the same five layers in the same order every time. The order matters because the early layers are pure waste with zero risk, while the later ones involve real trade-offs.
First, make the bill readable
You cannot cut what you cannot attribute. Before touching anything, tag every resource with three labels: the service it belongs to, the environment, and an owner. Untagged spend goes on a list, and the list gets worked until it is under 5 percent of the bill. This step feels bureaucratic and is the highest-value week of the whole exercise, because the moment a team sees "your services cost R84 000 last month", behaviour changes on its own.
Layer one: delete the zombies
Pure waste, zero risk, always present. Unattached storage volumes from deleted servers. Idle load balancers pointing at nothing. Old machine snapshots from 2023. Test environments for features that shipped a year ago. Databases with no connections in 90 days. At a fintech client this layer alone was 14 percent of the monthly bill, and the deletion script took an afternoon.
Make it permanent: schedule dev and test environments to shut down nights and weekends. An environment that runs 12 hours on weekdays instead of 24/7 costs 64 percent less, and nobody misses it at 03:00 on a Sunday.
Layer two: rightsize with data
Instances get sized by guesswork at launch and never revisited. Pull 30 days of utilisation and the pattern is always the same: servers idling at 8 percent CPU, databases using a tenth of their provisioned memory. Anything peaking under 40 percent utilisation is a candidate to drop one size, which halves its cost. Do it gradually, one size at a time with a week of observation, and start with non-production where a mistake costs nothing.
Layer three: storage and data transfer
Storage is where old data goes to cost money forever. Set lifecycle policies so logs, backups, and exports move to cold storage after 30 to 90 days and get deleted at your retention limit, which drops the per-gigabyte price by roughly 90 percent for data you will almost never read. Then look at data transfer, the line item everyone ignores: cross-zone chatter between services, traffic leaving the provider, images served without a CDN. Transfer costs are architecture smells, and a CDN in front of static content often pays for itself in the first month.
Layer four: commit only to the floor
Providers discount 30 to 60 percent when you commit to one or three years of usage. Do this last, never first, for one reason: committing before cleaning locks in your waste at a discount. After layers one to three, your bill has a stable floor, the baseline load that runs every hour of every year. Commit to that floor only, and let spiky workloads ride on-demand. Committing to the peak is how companies end up paying for capacity they use twelve days a year.
38%
average bill reduction across our last six cost reviews
14%
of one client bill that was zombie resources
64%
saved on dev environments by scheduling them off
Keep it down: cost as an engineering habit
The cut is the easy part. Staying cut requires three habits. A monthly 30-minute cost review per team, looking at their own tagged spend and any anomaly over 10 percent. A budget alert per service that pages the owner, not a shared inbox. And cost visibility in the pull request: when engineers can see that the new instance type doubles a line item, most bad decisions never ship.
- 1Week 1: tag everything, build the per-team cost view.
- 2Week 2: delete zombies, schedule non-production shutdowns.
- 3Weeks 3 to 5: rightsize one size at a time, non-production first.
- 4Week 6: lifecycle policies on storage, CDN in front of static traffic.
- 5Week 8: commit to the post-cleanup floor, and book the monthly review.
None of this needs a FinOps department. It needs two engineers, six weeks, and permission to delete things. If you would rather have someone who has done it twenty times run the review, our cloud services team offers it as a fixed-scope engagement, and it has paid for itself within the quarter every time we have run it.